Skip to content

Commit

Permalink
Fix spelling
Browse files Browse the repository at this point in the history
Signed-off-by: Babak K. Shandiz <[email protected]>
  • Loading branch information
babakks committed Jul 2, 2024
1 parent ceabead commit fa78582
Show file tree
Hide file tree
Showing 3 changed files with 5 additions and 4 deletions.
1 change: 1 addition & 0 deletions .custom_wordlist.txt
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,7 @@ Permalink
PostgreSQL
pre
Quickstart
RBAC
ReadMe
ReBAC
reST
Expand Down
4 changes: 2 additions & 2 deletions explanation/jaas_authorisation.rst
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
JAAS Authorisation
==================

JAAS provides enterprise-level features on top of Juju. One of such features is the `Relationship-Based Access Control (ReBAC) <https://en.wikipedia.org/wiki/Relationship-based_access_control>`_ that enables enterprises to have more control over users and their permissions to access underlying Juju resources (e.g. controllers or models). Among various implementations, JAAS uses `OpenFGA <https://openfga.dev/>`_ as the backend for ReBAC. You can read more about Juju permission model in `here <https://juju.is/docs/juju/user-permissions>`_.
JAAS provides enterprise-level features on top of Juju. One of such features is the `Relationship-Based Access Control (ReBAC) <https://en.wikipedia.org/wiki/Relationship-based_access_control>`_ that enables enterprises to have more control over users and their permissions to access underlying Juju resources (e.g. controllers or models). Among various implementations, JAAS uses `OpenFGA <https://openfga.dev/>`_ as the back-end for ReBAC. You can read more about Juju permission model in `here <https://juju.is/docs/juju/user-permissions>`_.

.. hint::
For a tutorial on managing users/groups permissions, check out :doc:`this <../tutorial/group_management>` topic.
Expand All @@ -10,7 +10,7 @@ JAAS provides enterprise-level features on top of Juju. One of such features is
What is ReBAC?
--------------

Unlike `Role-Based Access Control (RBAC) <https://en.wikipedia.org/wiki/Role-based_access_control>`_ where permission sets are managed by the concept of *roles*, in ReBAC, a user's access to a resource is modeled through a *relation*, which could be either direct or indirect (i.e. the result of another relation). This makes ReBAC more dynamic in comparison to RBAC, and also more suitable for complex authorisation schemes where there are large number of users and resources.
Unlike `Role-Based Access Control (RBAC) <https://en.wikipedia.org/wiki/Role-based_access_control>`_ where permission sets are managed by the concept of *roles*, in ReBAC, a user's access to a resource is modelled through a *relation*, which could be either direct or indirect (i.e. the result of another relation). This makes ReBAC more dynamic in comparison to RBAC, and also more suitable for complex authorisation schemes where there are large number of users and resources.

As an example, consider a simple file-system structure with two kinds of resources: directories and files. Without ReBAC, you need to be explicit about every user's permissions (or set of permissions, as roles) to every file or directory. But, with ReBAC, you can achieve the same result with much less effort and data, by defining the right relations. For instance, you can just assign the ``read::directory:foo`` relation to a user (meaning that the user has ``read`` relation to the ``directory`` named ``foo``), and then the user will have the read access to all files and directories under ``foo``. Note that, you only declared *one* relationship (or more precise, *tuple*), and the other relations are automatically inferred from that.

Expand Down
4 changes: 2 additions & 2 deletions reference/authorisation_model.rst
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ For example, if a ``user`` named ``[email protected]`` has the ``member`` rela
relation: member
target: group:foo
This reads as: "an entity of type *user*, named *[email protected]*, has *member* relationship to an entity of type *group*, named *foo*.
This reads as: "an entity of type ``user``, named ``[email protected]``, has ``member`` relationship to an entity of type ``group``, named ``foo``.


Manipulating tuples
Expand All @@ -94,7 +94,7 @@ To manipulate the tuples (i.e. add/remove relations between different resources)
jimmctl auth relation add [email protected] member group-foo
To check if a specific tuple exists, you use the ``check`` subcommand:
To check if a specific tuple exists, you use the ``relation check`` command:

.. code:: bash
Expand Down

0 comments on commit fa78582

Please sign in to comment.